Improper input validation in Samsung Pass before version 5.2.10.3 permits a local privileged attacker to write data beyond the intended memory buffer. This out‑of‑bounds write can corrupt memory structures and potentially allow the attacker to execute arbitrary code or elevate privileges. The description does not detail downstream effects, but an out‑of‑bounds write in a security‑related component strongly suggests that severe impacts such as code execution could be achievable.

Samsung Pass on Samsung mobile devices running any version earlier than 5.2.10.3. Versions 5.2.10.3 and later are assumed to contain the fix, as the description specifies the vulnerability exists only before this release.

The CVSS score of 6.8 indicates a moderate severity, while the EPSS score of less than 1% signals a very low‑but non‑zero likelihood of being exploited. The flaw is not listed in CISA KEV. Exploitation requires local privileged access; the attacker must be able to provide crafted input to the vulnerable application, leading to possible arbitrary code execution or privilege escalation.